FreeBSD : sudo -- Potential bypass of Runas user restrictions (3a1474ba-f646-11e9-b0af-b888e347c638)

Todd C. Miller reports : When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295. This can be used by a user with sufficient sudo privileges to run...

FreeBSD : FreeBSD -- Multiple vulnerabilities in bzip2 (3c7edc7a-f680-11e9-a87f-a4badb2f4699)

The decompressor used in bzip2 contains a bug which can lead to an out-of-bounds write when processing a specially crafted bzip21 file. bzip2recover contains a heap use-after-free bug which can be triggered when processing a specially crafted bzip21 file. Impact : An attacker who can cause...

FreeBSD : FreeBSD -- IPv6 remote Denial-of-Service (4d3d4f64-f680-11e9-a87f-a4badb2f4699)

Due do a missing check in the code of mpulldown9 data returned may not be contiguous as requested by the caller. Impact : Extra checks in the IPv6 code catch the error condition and trigger a kernel panic leading to a remote DoS denial-of-service attack with certain Ethernet interfaces. At this...

FreeBSD : FreeBSD -- Insufficient message length validation in bsnmp library (45a95fdd-f680-11e9-a87f-a4badb2f4699)

A function extracting the length from type-length-value encoding is not properly validating the submitted length. Impact : A remote user could cause, for example, an out-of-bounds read, decoding of unrelated data, or trigger a crash of the software such as bsnmpd resulting in a denial of service....

FreeBSD : FreeBSD -- Insufficient validation of guest-supplied data (e1000 device) (499b22a3-f680-11e9-a87f-a4badb2f4699)

The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload 'TSO'. The e1000 device model uses an on-stack buffer to generat...

FreeBSD : FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access (41d2f3e6-f680-11e9-a87f-a4badb2f4699)

The ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. Impact : A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently pani...

FreeBSD : FreeBSD -- kernel memory disclosure from /dev/midistat (5027b62e-f680-11e9-a87f-a4badb2f4699)

The kernel driver for /dev/midistat implements a handler for read2. This handler is not thread-safe, and a multi-threaded program can exploit races in the handler to cause it to copy out kernel memory outside the boundaries of midistat's data buffer. Impact : The races allow a program to read...

FreeBSD : Loofah -- XSS vulnerability (a90d040e-f5b0-11e9-acc4-4576b265fda6)

GitHub issue : This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported by https://hackerone.com/vxhex In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. C Tenable Networ...

Operating System (OS) Detection (PPTP)

PPTP service based Operating System OS detection. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : python 3.7 -- multiple vulnerabilities (9b7491fb-f253-11e9-a50c-000c29c4dc65)

Python changelog : bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. bpo-38174: Update vendorized expat library version to 2.2.8, which resolves CVE-2019-15903. bpo-37764: Fixes email.headervalueparser.getunstructured going into an...

FreeBSD : Pillow -- Allocation of resources without limits or throttling (998ca824-ef55-11e9-b81f-3085a9a95629)

Mitre reports : An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name. (273c6c43-e3ad-11e9-8af7-08002720423d)

Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports : Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. C Tenable...

FreeBSD : mongodb -- Attach IDs to users (880bca8f-e201-11e9-8af7-08002720423d)

Mitch Wasson of Cisco's Advanced Malware Protection Group reports : After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones...

FreeBSD : mongodb -- Bump Windows package dependencies (fd2e0ca8-e3ae-11e9-8af7-08002720423d)

Rich Mirch reports : An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the...

CVE-2018-1000156

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

FreeBSD : mod_perl2 -- execute arbitrary Perl code (c360d057-ea8b-11e9-859b-b885849ded8e)

modperl2 2.0.11 fixes Arbitrary Perl code execution in the context of the user account via a user-owned .htaccess. modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configurati...

FreeBSD : unbound -- parsing vulnerability (108a4be3-e612-11e9-9963-5f1753e0aca0)

Unbound Security Advisories : Due to an error in parsing NOTIFY queries, it is possible for Unbound to continue processing malformed queries and may ultimately result in a pointer dereference in uninitialized memory. This results in a crash of the Unbound daemon. C Tenable Network Security, Inc...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b17c86b9-e52e-11e9-86e9-001b217b3468)

SO-AND-SO reports : XSS in Markdown Preview Using Mermaid Bypass Email Verification using Salesforce Authentication Account Takeover using SAML Uncontrolled Resource Consumption in Markdown using Mermaid Disclosure of Private Project Path and Labels Disclosure of Assignees via Milestones Disclosu...

FreeBSD : cacti -- Authenticated users may bypass authorization checks (ed18aa92-e4f4-11e9-b6fa-3085a9a95629)

The cacti developers reports : In Cacti through 1.2.6, authenticated users may bypass authorization checks for viewing a graph via a direct graphjson.php request with a modified localgraphid parameter. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : ruby -- multiple vulnerabilities (f7fcb75c-e537-11e9-863e-b9b7af01ba9e)

Ruby news : This release includes security fixes. Please check the topics below for details. CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch? A NUL injection vulnerability of Ruby built-in methods File.fnmatch and File.fnmatch? was found. An attacker who has the...